File: //lib/python3/dist-packages/uaclient/entitlements/__pycache__/fips.cpython-38.pyc
U
��JhHf � @ s� d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl m
Z
m Z m Z m
Z
mZmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
l m Z d d l m Z m Z d d l!m"Z"m#Z#m$Z$ e �%� Z&e �'e�(e)��Z*d
ddddgZ+ddgZ,e+e, e+e, e+d�Z-dddgZ.dddddgZ/dddddgZ0e+e, e. e+e, e/ e+e0 d�Z1G d d � d ej2�Z3G d d � d e3�Z4G d d!� d!e3�Z5G d"d#� d#e4�Z6dS )$� N)�groupby)�List�Optional�Tuple)�api�apt� event_logger�
exceptions�messages�system�util)�NoCloudTypeReason�get_cloud_type)�repo)�EntitlementWithMessage)�ApplicationStatus)�notices)�Notice)�ServicesOnceEnabledData�services_once_enabled_file)�MessagingOperations�MessagingOperationsDict�StaticAffordance�
strongswan�strongswan-hmac�openssh-client�openssh-server� shim-signed�openssh-client-hmac�openssh-server-hmac)�xenial�bionic�focal�openssl� libssl1.0.0�libssl1.0.0-hmac� libssl1.1�libssl1.1-hmac� libgcrypt20�libgcrypt20-hmacc s� e Zd ZdZdZdZejZdZ dZ
ej j Z
ddddd d
d d d
dd
ddddddddddddddd d d d g Zeed �d!d"��Zed#d$� �Zeed%�d&d'�Zejd(�d)d*�Zed �d+d,�Zejd(�d-d.�ZdNejeee ed/d0�� fd1d2�
Z ed �d3d4�Z dOe ed/d6�d7d8�Z e e ed9�� fd:d;� Z ee!e"d<f d �d=d>��Z#eee d �� fd?d@� �Z$e!e%eej& f d �� fdAdB� Z'd/d �dCdD�Z(ejedE�� fdFdG� Z)ejedE�� fdHdI� Z*dJdK� Z+ejd/dE�� fdLdM� Z,� Z-S )P�FIPSCommonEntitlementi� zubuntu-pro-fips.gpgz /proc/sys/crypto/fips_enabledTzfips-initramfszfips-initramfs-genericr( r) Zlibgmp10Z libgnutls30Z libhogweed6Z
libnettle8r$ r% r& r' Zlibssl3�
linux-fipsr r r r r# �openssl-fips-module-3r r r z ubuntu-fipszubuntu-aws-fipszubuntu-azure-fips�ubuntu-gcp-fips��returnc C s6 d }d }| j sNt�� r8tjj| jd�}| �� s>tjg}n| j }t
j d|ifg}d }| j sz| j szt
j dtj
j| jd�ifg}| j s�| ji fgnd }||||d�}t| j�dk�r2| jd }t�d|�}|r�|�d�} nd} t�� j}
| |
k�r2|�d�p�g }tjj| | j| |
�pd d
�} |�t
j d| if� ||d< |S ) N��title�msg)�
pre_enable� pre_install� post_enable� pre_disable� r zubuntu-([a-z]+)-fipsZgenericr3 �unknown)Zvariant�serviceZ base_flavor�current_flavor)Z access_onlyr � is_containerr
Z PROMPT_FIPS_CONTAINER_PRE_ENABLE�formatr1 �auto_upgrade_all_on_enableZFIPS_RUN_APT_UPGRADE�pre_enable_msgr �prompt_for_confirmation�purgeZPROMPT_FIPS_PRE_DISABLE�prompt_if_kernel_downgrade�len�packages�re�match�group�get_kernel_infoZflavor�getZ#KERNEL_FLAVOR_CHANGE_WARNING_PROMPT�name�append) �selfr3 r5 Zpre_enable_promptr6 r4 � messagingZubuntu_fips_package_nameZ ubuntu_fips_package_flavor_matchZubuntu_fips_package_flavorr: r2 � rM �</usr/lib/python3/dist-packages/uaclient/entitlements/fips.pyrL � s� ��
�� �������� �
��
���z FIPSCommonEntitlement.messagingc C s* t �� j}t �� r t�|g �S t�|g �S )a�
Dictionary of conditional packages to be installed when
enabling FIPS services. For example, if we are enabling
FIPS services in a machine that has openssh-client installed,
we will perform two actions:
1. Upgrade the package to the FIPS version
2. Install the corresponding hmac version of that package
when available.
)r �get_release_info�seriesr; �#FIPS_CONTAINER_CONDITIONAL_PACKAGESrH �FIPS_CONDITIONAL_PACKAGES)rK rP rM rM rN �conditional_packages� s
z*FIPSCommonEntitlement.conditional_packages)�
assume_yesr/ c C s� t �� j}|dkr t�d� dS t�d|�}t�d�}|dk r�|dk r�|� d�}t�
d||� t� ||�dk r�t �
tjj||d �� tjtj|d
�S nt�d ||� d S )
ztCheck if installing a FIPS kernel will downgrade the kernel
and prompt for confirmation if it will.
Nz Cannot gather kernel informationFz!(?P<kernel_version>\d+\.\d+\.\d+)r+ Zkernel_versionz*Kernel information: cur='%s' and fips='%s'r )Zcurrent_versionZ new_version)r2 rT z2Cannot gather kernel information for '%s' and '%s'T)r rG Z proc_version_signature_version�LOG�warningrD �searchr Zget_pkg_candidate_versionrF �debugZversion_compare�event�infor
ZKERNEL_DOWNGRADE_WARNINGr< r r? Z
PROMPT_YES_NO)rK rT Zour_full_kernel_strZour_mZfips_kernel_version_strZour_kernel_version_strrM rM rN rA � sP �
�
� ����� ��z0FIPSCommonEntitlement.prompt_if_kernel_downgrade��progressc C s� g }t �� }tt| j�dd� d�}|D ]\}}||kr&||7 }q&|D ]V}z t j|gddidddgd � W qD tjk
r� |�d
t j
j | j |d �� Y qDX qDd S ) Nc S s | � dd�S )Nz-hmac� )�replace)�pkg_namerM rM rN �<lambda># � zNFIPSCommonEntitlement.hardcoded_install_conditional_packages.<locals>.<lambda>)�key�DEBIAN_FRONTEND�noninteractive�--allow-downgrades�$-o Dpkg::Options::="--force-confdef"�$-o Dpkg::Options::="--force-confold"�rC Zoverride_env_varsZ apt_optionsrZ )r9 �pkg)
r � get_installed_packages_namesr �sortedrS �run_apt_install_commandr �UbuntuProError�emitr
ZFIPS_PACKAGE_NOT_AVAILABLEr< r1 )rK r\ Zdesired_packages�installed_packagesZ
pkg_groupsr_ Zpkg_listri rM rM rN �&hardcoded_install_conditional_packages s6 �
��
��z<FIPSCommonEntitlement.hardcoded_install_conditional_packagesc C s* t j| jjdd�}t�� jdk}|p(| S )Nz features.fips_auto_upgrade_all�ZconfigZ
path_to_value> r! r r" )r �is_config_value_true�cfgr rO rP )rK Z install_all_updates_overrideZhardcoded_releaserM rM rN r= = s �z0FIPSCommonEntitlement.auto_upgrade_all_on_enablec C s� dd� t �| j�D �}t�� jdkr.|�d� |�� t|�dkr�zD|� dt
j j d�
|�d�� | �|� t j|d d
id d d
gd� W n$ tjk
r� |� dt
j� Y nX d S )Nc S s g | ]
}|j �qS rM )rI )�.0�packagerM rM rN �
<listcomp>L s �zMFIPSCommonEntitlement.install_all_available_fips_upgrades.<locals>.<listcomp>Zjammyr, r rZ � )rC rc rd re rf rg rh )r Z;get_installed_packages_with_uninstalled_candidate_in_origin�originr rO rP rJ �sortrB rn r
ZINSTALLING_PACKAGESr< �join�unhold_packagesrl r rm Z FIPS_PACKAGES_UPGRADE_FAILURE)rK r\ Z
to_upgraderM rM rN �#install_all_available_fips_upgradesI s6 ��
��
��
z9FIPSCommonEntitlement.install_all_available_fips_upgradesN)r\ � package_list�cleanup_on_failurer/ c sh | j }|r t� j||d� n|�tjj| jd�� | �� rF| � |� n
| �
|� | � � rdt �
tj� dS )z�Install contract recommended packages for the entitlement.
:param package_list: Optional package list to use instead of
self.packages.
:param cleanup_on_failure: Cleanup apt files if apt install fails.
)r} r0 N)rC �super�install_packagesr\ r
ZINSTALLING_SERVICE_PACKAGESr< r1 r= r| rp �_check_for_rebootr �addr �FIPS_SYSTEM_REBOOT_REQUIRED)rK r\ r} r~ Zmandatory_packages�� __class__rM rN r� m s ��
�z&FIPSCommonEntitlement.install_packagesc C s t �� S )z=Check if system needs to be rebooted because of this service.)r �
should_reboot�rK rM rM rN r� � s z'FIPSCommonEntitlement._check_for_rebootF)� operation�silentr/ c C sF | � � }t�|� |rB|s.t�tjj|d�� |dkrBt�t j
� dS )z�Check if user should be alerted that a reboot must be performed.
@param operation: The operation being executed.
@param silent: Boolean set True to silence print/log of messages
)r� zdisable operationN) r� rY Z needs_rebootrZ r
ZENABLE_REBOOT_REQUIRED_TMPLr< r r� r � FIPS_DISABLE_REBOOT_REQUIRED)rK r� r� Zreboot_requiredrM rM rN �_check_for_reboot_msg� s
���z+FIPSCommonEntitlement._check_for_reboot_msg�rP �cloud_idr/ c s> |dkr:t j| jjdd�r dS |dkr*dS tdt� jk�S dS )aV Return False when FIPS is allowed on this cloud and series.
On Xenial GCP there will be no cloud-optimized kernel so
block default ubuntu-fips enable. This can be overridden in
config with features.allow_xenial_fips_on_cloud.
GCP doesn't yet have a cloud-optimized kernel or metapackage so
block enable of fips if the contract does not specify ubuntu-gcp-fips.
This also can be overridden in config with
features.allow_default_fips_metapackage_on_gcp.
:return: False when this cloud, series or config override allows FIPS.
�gcez.features.allow_default_fips_metapackage_on_gcprq T)r! r" r- )r rr rs �boolr rC �rK rP r� r� rM rN � _allow_fips_on_cloud_instance� s �z3FIPSCommonEntitlement._allow_fips_on_cloud_instance.c s^ dddd�}t � \� }� d kr"d� t�� j�tjj��� |�� �d�}|� ��fdd�d ffS )
Nzan AWSzan Azureza GCP)ZawsZazurer� r] )rP Zcloudc s �� �� �S �N)r� rM �r� rK rP rM rN r` � ra z:FIPSCommonEntitlement.static_affordances.<locals>.<lambda>T) r r rO rP r
ZFIPS_BLOCK_ON_CLOUDr< r1 rH )rK Z cloud_titles�_Zblocked_messagerM r� rN �static_affordances� s
���z(FIPSCommonEntitlement.static_affordancesc s t �� r g S t� jS r� )r r; r rC r� r� rM rN rC � s z FIPSCommonEntitlement.packagesc s t � �� \}}t�� r2t�� s2t�tj� ||fS t j
� | j �r�t�t
| j��s\t�tj� t�| j ��� dkr�t�tj� ||fS t�tj� tjtjj| j d�fS |tjkr�||fS t�� }g }| jD ]}||kr�|�|� q�|�rtj tj jd� |�| j d�fS tjtj fS )N�1)� file_namerw )rC r9 )!r �application_statusr r; r� r �remover r� �os�path�exists�FIPS_PROC_FILE�setrC Z load_file�stripZFIPS_MANUAL_DISABLE_URLr� r �DISABLEDr
ZFIPS_PROC_FILE_ERRORr< ZENABLEDr rj rJ ZWARNINGZFIPS_PACKAGES_NOT_INSTALLEDrz rI �FIPS_REBOOT_REQUIRED)rK Z super_statusZ super_msgro Zmissingru r� rM rN r� � sR ������
���z(FIPSCommonEntitlement.application_statusc C sP t t�� �}t | j��t | j��}|�|�}|rLt�t|�t j
j | j d�� dS )z�Remove fips meta package to disable the service.
FIPS meta-package will unset grub config options which will deactivate
FIPS on any related packages.
r0 N)
r� r rj rC �
differencerS � intersection�remove_packages�listr
ZDISABLE_FAILED_TMPLr< r1 )rK ro Zfips_metapackager� rM rM rN r� s
�
�z%FIPSCommonEntitlement.remove_packages�r\ r/ c s8 t � �|�r4t�tj� t�tj� t�tj� dS dS �NTF)r �_perform_enabler r� r Z WRONG_FIPS_METAPACKAGE_ON_CLOUDr� r� �rK r\ r� rM rN r� 1 s � z%FIPSCommonEntitlement._perform_enablec s( t � �|�r$| �� r t�tj� dS dS r� )r �_perform_disabler� r r� r r� r� r� rM rN r� < s �z&FIPSCommonEntitlement._perform_disablec C sx ddg}t �|tjjd�|�d��}g }|�� D ]}||kr0|�|� q0|rtddg| }t �|tjjd�|�d��}d S )Nzapt-markZ showholdsrw )ZcommandZunhold)r Zrun_apt_commandr
ZEXECUTING_COMMAND_FAILEDr< rz �
splitlinesrJ )rK Z
package_names�cmdZholdsZunholdsZholdZ
unhold_cmdrM rM rN r{ F s" � ��z%FIPSCommonEntitlement.unhold_packagesc s | � | j� t� �|� dS )z�Setup apt config based on the resourceToken and directives.
FIPS-specifically handle apt-mark unhold
:raise UbuntuProError: on failure to setup any aspect of this apt
configuration
N)r{ �fips_pro_package_holdsr �setup_apt_configr� r� rM rN r� Y s z&FIPSCommonEntitlement.setup_apt_config)NT)F).�__name__�
__module__� __qualname__Zrepo_pin_priority�
repo_key_filer� r
�PROMPT_FIPS_PRE_ENABLEr> Zsupports_access_onlyZapt_noninteractiveZurlsZFIPS_HOME_PAGEZ help_doc_urlr� �propertyr rL rS r� rA r �ProgressWrapperrp r= r| r r �strr� r� r� r� r r r� rC r Z NamedMessager� r� r� r� r{ r� �
__classcell__rM rM r� rN r* V s� � T
/� #
� ' �
�& � � � �;
r* c s~ e Zd ZdZejZejZej Z
dZ ej Z
eeedf d�dd��Zeeedf d�� fdd� �Zejed �� fd
d � Z� ZS ) �FIPSEntitlement�fipsZ
UbuntuFIPS.r. c C s: ddl m} ddlm} t|tj�tttj�t|tj �fS )Nr )�LivepatchEntitlement��RealtimeKernelEntitlement)
Z uaclient.entitlements.livepatchr� � uaclient.entitlements.realtimer� r r
ZLIVEPATCH_INVALIDATES_FIPS�FIPSUpdatesEntitlementZ FIPS_UPDATES_INVALIDATES_FIPSZREALTIME_FIPS_INCOMPATIBLE)rK r� r� rM rM rN �incompatible_servicesm s � � ��z%FIPSEntitlement.incompatible_servicesc s� t � j}t| jd�}tj}t|�� d |k��t� � }|r@|j
nd� |t j j
| j|jd��fdd�dft jj
| j|jd�� fdd�dff S )N)rs r F)r� � fips_updatesc s � S r� rM rM )�is_fips_updates_enabledrM rN r` � ra z4FIPSEntitlement.static_affordances.<locals>.<lambda>c s � S r� rM rM )�fips_updates_once_enabledrM rN r` � ra )r r� r� rs r r� r� r� r �readr� r
Z$FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDr< r1 Z)FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)rK r� r� Zdisabled_statusZservices_once_enabled_objr� )r� r� rN r� ~ s6 ��� �
� �
��z"FIPSEntitlement.static_affordancesr� c sR t � \}}|d kr2|tjkr2t�d� t�tj� t � �
|�rNt � t
j� dS dS )Nz>Could not determine cloud, defaulting to generic FIPS package.TF)r r
ZCLOUD_ID_ERRORrU rV rY rZ r
Z.FIPS_COULD_NOT_DETERMINE_CLOUD_DEFAULT_PACKAGEr r� r r� r ZFIPS_INSTALL_OUT_OF_DATE)rK r\ Z
cloud_type�errorr� rM rN r� � s
� �z FIPSEntitlement._perform_enable)r� r� r� rI r
Z
FIPS_TITLEr1 ZFIPS_DESCRIPTION� descriptionZFIPS_HELP_TEXT� help_textrx r� r> r� r r r� r r� r r� r� r� r� rM rM r� rN r� e s !r� c s` e Zd ZdZejZdZejZ ej
Z ej Z
eeedf d�dd��Zejed�� fdd � Z� ZS )
r� z fips-updatesZUbuntuFIPSUpdates.r. c C s$ ddl m} tttj�t|tj�fS )Nr r� )r� r� r r� r
� FIPS_INVALIDATES_FIPS_UPDATESZ"REALTIME_FIPS_UPDATES_INCOMPATIBLE)rK r� rM rM rN r� � s ���z,FIPSUpdatesEntitlement.incompatible_servicesr� c s& t � j|d�r"t�tdd�� dS dS )Nr[ T)r� F)r r� r �writer r� r� rM rN r� � s �z&FIPSUpdatesEntitlement._perform_enable)r� r� r� rI r
ZFIPS_UPDATES_TITLEr1 rx ZFIPS_UPDATES_DESCRIPTIONr� ZFIPS_UPDATES_HELP_TEXTr� Z PROMPT_FIPS_UPDATES_PRE_ENABLEr> r� r r r� r r� r� r� r� rM rM r� rN r� � s
r� c sd e Zd ZdZejZejZej Z
dZ ej Z
dZeeedf d�� fdd� �Zeeed�d d
�Z� ZS ) �FIPSPreviewEntitlementz fips-previewZUbuntuFIPSPreviewzubuntu-pro-fips-preview.gpg.r. c s t � jtttj�f S r� )r r� r r� r
r� r� r� rM rN r� � s ��z,FIPSPreviewEntitlement.incompatible_servicesr� c C s dS )NTrM r� rM rM rN r� � s z4FIPSPreviewEntitlement._allow_fips_on_cloud_instance)r� r� r� rI r
ZFIPS_PREVIEW_TITLEr1 ZFIPS_PREVIEW_DESCRIPTIONr� ZFIPS_PREVIEW_HELP_TEXTr� rx Z PROMPT_FIPS_PREVIEW_PRE_ENABLEr> r� r� r r r� r� r� r� r� rM rM r� rN r� � s �r� )7Zloggingr� rD � itertoolsr �typingr r r Zuaclientr r r r r
r r Zuaclient.clouds.identityr
r Zuaclient.entitlementsr Zuaclient.entitlements.baser Z(uaclient.entitlements.entitlement_statusr Zuaclient.filesr Zuaclient.files.noticesr Zuaclient.files.state_filesr r Zuaclient.typesr r r Zget_event_loggerrY Z getLoggerZ replace_top_level_logger_namer� rU Z CONDITIONAL_PACKAGES_EVERYWHEREZ!CONDITIONAL_PACKAGES_OPENSSH_HMACrR Z&UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIALZ&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONICZ%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCALrQ ZRepoEntitlementr* r� r� r� rM rM rM rN �<module> s� $ �������������� L